Dex posted:

my car has a warning light telling me to check the engine, so i started parking it by slamming it into walls. idiot hellbox trying to tell me how to live my life, gently caress that noise

Platystemon posted:

If my car forcibly pulled off the road every Tuesday for yet another recall, I’d be livid.

Teddybear posted:

Microsoft dusted off the update tools for XP, 8, and Server 2003 for this, which gives you an idea of who is being hit.

Apparently a researcher saw that the code checked a specific lengthy non existent domain name with every infection, so he bought that domain name and accidentally tripped a failsafe pausing further spread. If it finds that domain exists it cancels its attempt to infect the computer.

Teddybear posted:

Apparently a researcher saw that the code checked a specific lengthy non existent domain name with every infection, so he bought that domain name and accidentally tripped a failsafe pausing further spread. If it finds that domain exists it cancels its attempt to infect the computer.

Malachite_Dragon posted:

I suddenly really want to know what the killswitch domain name was.

Humphreys posted:

https://crashoveride.do.not

And in an ideal world the URL would play the one loving good song from the Hackers soundtrack:

https://www.youtube.com/watch?v=bV-hSgL1R74

Teddybear posted:

Microsoft dusted off the update tools for XP, 8, and Server 2003 for this, which gives you an idea of who is being hit.

marshmallow creep posted:

The computer I use for office work on Fridays is still using XP, as is the data entry terminal one step down. They are both the only two computers that can access our internal database. I have no idea when anything was last backed up.

Ak Gara posted:

"How an idiot designs a bike race"
https://www.youtube.com/watch?v=PXO_AqzVDB4

PostNouveau posted:

Why?

Takes No Damage posted:

Doesn't look like they had police controlling each intersection on the race path either. Every once in a while a big group will ride through downtown Dallas and I've been stuck behind a green light with 100 cyclists just blowing through the red with no apparent authority or control. I've never done it, but in the dark, lizard-brain recesses of my mind I'm always tempted. "They had red I had green I don't know what happened officer I swear."

Sagebrush posted:

i have no idea how that race was supposed to go, because it looked like just a giant goddamned mess, but lmao @ the douchebag who eats it hard after trying to bunny-hop over the injured person lying in the road (GOTTA GO FAST!). Beautiful.

it's me, the hippie bicycle commuter who is constantly angry at hobbyist bike racers treating the bike paths like their personal training track

insta posted:

It looked more like he was clipped in and couldn't stop hard enough. Now, WHY he couldn't stop hard enough is another question...

Also, what the gently caress was the Volt driver doing?

quote:

Hi-
I was there. The video seems confusing, and I'd like to clarify. (I was the rider who hit the official-- you can just see me tumbling in front of the car).

This was the Air-Force Classic in Arlington, VA.
That part of the course was used for two directions of the race, with no barriers separating the two directions.
This part of the course was the beginning of a small, 500m loop, where riders pass this spot and return in the other direction.

You can see the field coming through, setting up for a left turn, to begin the loop.
A breakaway was about 20 seconds in front of the field, and arrived at that junction at the same moment as the tail of the field.
The organization's solution was to put a person in the middle of the road, waving her hands, telling us to keep left. Lap after lap, as the field moved like a snake, the road marshal could be seen running for her life as the tail of the field whipped closer to her.
This last time, however, she didn't run fast enough. In one second, I was gripping to the wheel of the rider in front of me (it was at about 10 laps to go). A second later, the rider in front of me swerved left, and i rode directly into the marshal. She was running. I had no time to react. Bam!
The video picks it up where we're both tumbling.

Now the car--- that was the race's lead moto (you can see the breakaway riders coming through a few seconds later). When he stopped, his front bumper was over my head. That's how close I came to dying that day.

Then after that, the rest of the field came through. The location of the incident is also right where the race re-enters that straightaway, so the riders had little time to react to the car, and to the bodies on the ground.

I hope this clarifies.

bobjr posted:

Humphreys posted:

https://crashoveride.do.not

And in an ideal world the URL would play the one loving good song from the Hackers soundtrack:

https://www.youtube.com/watch?v=bV-hSgL1R74

Teddybear posted:

Microsoft dusted off the update tools for XP, 8, and Server 2003 for this, which gives you an idea of who is being hit.

Apparently a researcher saw that the code checked a specific lengthy non existent domain name with every infection, so he bought that domain name and accidentally tripped a failsafe pausing further spread. If it finds that domain exists it cancels its attempt to infect the computer.

Platystemon posted:

So was that the blackhat’s plan all along?

The first whitehat to dig into the code finds the domain. The purchase of that domain signals that the jig is up.

In short, it’s a canary.

Teddybear posted:

Probably if he needed to stop the spread for whatever reason, he would have a way to do so. Someone just found it.

Dex posted:

most of those tools are made to order, with the author taking a cut of the proceeds. if your client stops paying up, you turn on the killswitch and gently caress their business

quote:

The reason which was suggested is that the domain is a “kill switch” in case something goes wrong, but I now believe it to be a badly thought out anti-analysis.

In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen).

I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis.

Platystemon posted:

Article by the researcher who registered the domain.

Rough Lobster posted:

*pretending to be smart enough to understand any of this*

Aha, yes! Of course!

Rough Lobster posted:

*pretending to be smart enough to understand any of this*

Aha, yes! Of course!

Sagebrush posted:

The researcher is saying that when security researchers study malware, they run it in a virtual environment (emulated computer) where any attempts made by the malware to connect to external hosts (servers) are automatically redirected to a research computer, which pretends to be the host in question. That lets the researcher capture and examine the data that the malware is trying to send. This particular bit of software tries to connect to a gibberish website that shouldn't exist, and if it does manage to connect, it shuts down. The researcher thinks that this is a counter-analysis feature -- the malware knows the website should not exist, so if it does, it might mean the malware is running in a research system that pretends to be whatever the malware wants.

It's clever.

TotalLossBrain posted:

I'm not sure it makes sense as an anti-analysis technique, though. It relies on the presence of a complex url in the (unknown?) analysis environment to work.

Sagebrush posted:

The researcher is saying that when security researchers study malware, they run it in a virtual environment (emulated computer) where any attempts made by the malware to connect to external hosts (servers) are automatically redirected to a research computer, which pretends to be the host in question. That lets the researcher capture and examine the data that the malware is trying to send. This particular bit of software tries to connect to a gibberish website that shouldn't exist, and if it does manage to connect, it shuts down. The researcher thinks that this is a counter-analysis feature -- the malware knows the website should not exist, so if it does, it might mean the malware is running in a research system that pretends to be whatever the malware wants.

It's clever.

syscall girl posted:

I can't tell if leaving the test stuff in is stupid and clumsy since you should know not to publish that way?